4 ms·

NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.

by growse 2y ago

cyberax 2y ago
NAT _is_ a firewall. And it provides the same level of security as pretty much all of the "firewalls" marketed as such.
- growse 2y ago
  No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.
  - mixmastamyk 2y ago
    I’ve never seen one without the other, so while technically correct, not useful to debate.
    - growse 2y ago
      shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
      - mixmastamyk 2y ago
        We out-number companies, perhaps by an order of magnitude.
        growse 2y ago
        Not by allocated IP address count.
    - Dagger2 2y ago
      It's useful to correct this misunderstanding, because people often take "I've always seen NAT come with firewalling" to mean "firewalls are impossible without NAT". You quite regularly see people pop up in these threads arguing something like, oh, I dunno, "In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall.", as if this is somehow a problem with IPv6 rather than a problem with their own understanding. It's hard enough to get people to deploy v6 as it is without them mistakenly believing that a lack of NAT means their router can't provide firewalling either.
  - cyberax 2y ago
    It automatically prevents the outside world from being able to access the inside network. Which is the main function of most of the firewalls. Pretty much everything else in a firewall in the modern world is just useless feature creep.
    - Dagger2 2y ago
      It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. Take two networks that are identical, except one is doing NAT and one isn't, and test them. Every connection that works on the without-NAT network will also work on the with-NAT network. The only difference you'll find is that some outbound connections which didn't work on the former will work on the latter. Some would argue that "every connection that used to work still works, and some connections that didn't work before do now work" is kind of the opposite of a firewall.
      - cyberax 2y ago
        > It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. It absolutely does. There is no way with NAT to connect from the outside network to the inside ("but what if the attacker is directly attached to the next hop blahblahblah"). That's all that firewalls need to do, everything else is useless noise in the current world. > Take two networks that are identical, except one is doing NAT and one isn't, and test them. Here's my IP: 192.168.80.36. Feel free to attack me. Go on. The public IPv4 of my router is 76.191.126.81. I even opened a port 8871 for you with a static page with a Bitcoin wallet worth $1000, you just need to get to it. You can't. There's no way to get to my computer without hacking the NAT server first. That's why NAT _is_ a firewall, and a foolproof one at that. It's secure by default, unlike IPv6 firewalls that can fail open.
        growse 2y ago
        I've just remembered the firewall alignment chart, which asserts a view of the world that an excavator is a firewall. https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0-1df7368a748c.jpeg?format=webp https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0...
- bigstrat2003 2y ago
  NAT is by definition not a firewall. And while it provides security, it provides no more security than having a firewall, while making various scenarios worse. NAT is not a good solution for security.
lmm 2y ago
It forces the use of some system that statefully tracks packets and makes routing decisions based on that information. Such a system will be capable of firewalling unless you go out of your way to make it not.
- growse 2y ago
  Pretty much any system that's capable of handling IP traffic is also capable of firewalling. Not sure what that's got to do with address rewriting though.
  - lmm 2y ago
    > Pretty much any system that's capable of handling IP traffic is also capable of firewalling. A system that can't track connection state, or doesn't have enough capacity to do so at line rate, can't meaningfully firewall. When the norm for home equipment is ISPs sending it out for "free", they absolutely send out the cheapest stuff they can get away with, and in the pre-smartphone era that meant "modems" that would just provide a straight PPPoA connection with no firewalling.
- namibj 2y ago
  No, your thinking of a stateful IPv4 home style NAT. There's also stateless subnet mapping.
  - lmm 2y ago
    There are some stateless things that are also called NAT, sure, but that's not what we're talking about here. (Fairly obviously, since a stateless mapping doesn't and can't save addresses).
    - growse 2y ago
      But this feels tautological. It's been reduced to "If you want to use NAT with features that only a firewall gives you, then that forces you to use a firewall". I suspect when people talk about "NAT" in the context of a residential connection, what they actually mean is a "default-deny firewall with connection tracking".
gruturo 2y ago
In the most commonly (almost exclusively, in case of end users) deployed setups (call them NAT Masquerade, NAT Hide, NAT Overload, NAT Many-to-One, PAT, whatever) it does block incoming connections, only allowing replies to internally-originated traffic, and to do that it tracks the state of all traffic. Is that a real, full firewall? Heck no, I'm equally worried about what my systems leak than outside threats, and it does nothing for that. but aren't we nitpicking a little here? veering on the "technically correct, worst kind of correct".
- cesarb 2y ago
  > In the most commonly (almost exclusively, in case of end users) deployed setups (call them NAT Masquerade, NAT Hide, NAT Overload, NAT Many-to-One, PAT, whatever) it does block incoming connections, only allowing replies to internally-originated traffic, and to do that it tracks the state of all traffic. Yes, but that's because it's co-located with a stateful firewall, sharing the same connection tracking state. Without that firewall, if a device on the WAN side sends to your router a packet with destination address on the LAN side, your router will route that packet to the LAN, even though it's not a reply to anything sent from the LAN to the WAN. That is: it's a misconception that port mapping NAT blocks incoming connections; port mapping NAT only affects outgoing connections and replies to them.
  - cyberax 2y ago
    > if a device on the WAN side sends to your router a packet with destination address on the LAN side This can happen only if the device is directly attached to the NAT server. Basically, only your ISP can do that. Most NAT servers by default also prohibit this kind of routing (because why even allow it?!?), but even the most misconfigured bad NAT server is still vulnerable only if you control the ISP, in practice.
- cyberax 2y ago
  > Is that a real, full firewall? Heck no, I'm equally worried about what my systems leak than outside threats, and it does nothing for that. But it is. Even a "full" firewall can't do anything against something on one of the inner host leaking into the outside. Most of the traffic is encrypted, even DNS. So the firewall can't operate on much more than the destination address to decide if a connection should be allowed. If you want more security, you need to secure individual endpoints.

NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.

by growse 2y ago

NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.

cyberax 2y ago

NAT _is_ a firewall. And it provides the same level of security as pretty much all of the "firewalls" marketed as such.

growse 2y ago
No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.
- mixmastamyk 2y ago
  I’ve never seen one without the other, so while technically correct, not useful to debate.
  - growse 2y ago
    shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
    - mixmastamyk 2y ago
      We out-number companies, perhaps by an order of magnitude.
      - growse 2y ago
        Not by allocated IP address count.
  - Dagger2 2y ago
    It's useful to correct this misunderstanding, because people often take "I've always seen NAT come with firewalling" to mean "firewalls are impossible without NAT". You quite regularly see people pop up in these threads arguing something like, oh, I dunno, "In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall.", as if this is somehow a problem with IPv6 rather than a problem with their own understanding. It's hard enough to get people to deploy v6 as it is without them mistakenly believing that a lack of NAT means their router can't provide firewalling either.
- cyberax 2y ago
  It automatically prevents the outside world from being able to access the inside network. Which is the main function of most of the firewalls. Pretty much everything else in a firewall in the modern world is just useless feature creep.
  - Dagger2 2y ago
    It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. Take two networks that are identical, except one is doing NAT and one isn't, and test them. Every connection that works on the without-NAT network will also work on the with-NAT network. The only difference you'll find is that some outbound connections which didn't work on the former will work on the latter. Some would argue that "every connection that used to work still works, and some connections that didn't work before do now work" is kind of the opposite of a firewall.
    - cyberax 2y ago
      > It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. It absolutely does. There is no way with NAT to connect from the outside network to the inside ("but what if the attacker is directly attached to the next hop blahblahblah"). That's all that firewalls need to do, everything else is useless noise in the current world. > Take two networks that are identical, except one is doing NAT and one isn't, and test them. Here's my IP: 192.168.80.36. Feel free to attack me. Go on. The public IPv4 of my router is 76.191.126.81. I even opened a port 8871 for you with a static page with a Bitcoin wallet worth $1000, you just need to get to it. You can't. There's no way to get to my computer without hacking the NAT server first. That's why NAT _is_ a firewall, and a foolproof one at that. It's secure by default, unlike IPv6 firewalls that can fail open.
      - growse 2y ago
        I've just remembered the firewall alignment chart, which asserts a view of the world that an excavator is a firewall. https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0-1df7368a748c.jpeg?format=webp https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0...
bigstrat2003 2y ago
NAT is by definition not a firewall. And while it provides security, it provides no more security than having a firewall, while making various scenarios worse. NAT is not a good solution for security.

lmm 2y ago

It forces the use of some system that statefully tracks packets and makes routing decisions based on that information. Such a system will be capable of firewalling unless you go out of your way to make it not.

growse 2y ago
Pretty much any system that's capable of handling IP traffic is also capable of firewalling. Not sure what that's got to do with address rewriting though.
- lmm 2y ago
  > Pretty much any system that's capable of handling IP traffic is also capable of firewalling. A system that can't track connection state, or doesn't have enough capacity to do so at line rate, can't meaningfully firewall. When the norm for home equipment is ISPs sending it out for "free", they absolutely send out the cheapest stuff they can get away with, and in the pre-smartphone era that meant "modems" that would just provide a straight PPPoA connection with no firewalling.
namibj 2y ago
No, your thinking of a stateful IPv4 home style NAT. There's also stateless subnet mapping.
- lmm 2y ago
  There are some stateless things that are also called NAT, sure, but that's not what we're talking about here. (Fairly obviously, since a stateless mapping doesn't and can't save addresses).
  - growse 2y ago
    But this feels tautological. It's been reduced to "If you want to use NAT with features that only a firewall gives you, then that forces you to use a firewall". I suspect when people talk about "NAT" in the context of a residential connection, what they actually mean is a "default-deny firewall with connection tracking".

gruturo 2y ago

In the most commonly (almost exclusively, in case of end users) deployed setups (call them NAT Masquerade, NAT Hide, NAT Overload, NAT Many-to-One, PAT, whatever) it does block incoming connections, only allowing replies to internally-originated traffic, and to do that it tracks the state of all traffic. Is that a real, full firewall? Heck no, I'm equally worried about what my systems leak than outside threats, and it does nothing for that. but aren't we nitpicking a little here? veering on the "technically correct, worst kind of correct".

cesarb 2y ago
> In the most commonly (almost exclusively, in case of end users) deployed setups (call them NAT Masquerade, NAT Hide, NAT Overload, NAT Many-to-One, PAT, whatever) it does block incoming connections, only allowing replies to internally-originated traffic, and to do that it tracks the state of all traffic. Yes, but that's because it's co-located with a stateful firewall, sharing the same connection tracking state. Without that firewall, if a device on the WAN side sends to your router a packet with destination address on the LAN side, your router will route that packet to the LAN, even though it's not a reply to anything sent from the LAN to the WAN. That is: it's a misconception that port mapping NAT blocks incoming connections; port mapping NAT only affects outgoing connections and replies to them.
- cyberax 2y ago
  > if a device on the WAN side sends to your router a packet with destination address on the LAN side This can happen only if the device is directly attached to the NAT server. Basically, only your ISP can do that. Most NAT servers by default also prohibit this kind of routing (because why even allow it?!?), but even the most misconfigured bad NAT server is still vulnerable only if you control the ISP, in practice.
cyberax 2y ago
> Is that a real, full firewall? Heck no, I'm equally worried about what my systems leak than outside threats, and it does nothing for that. But it is. Even a "full" firewall can't do anything against something on one of the inner host leaking into the outside. Most of the traffic is encrypted, even DNS. So the firewall can't operate on much more than the destination address to decide if a connection should be allowed. If you want more security, you need to secure individual endpoints.